vboot.git
5 years agoUpdate a utility to support the new tpm sysfs class directory
Bryan Freed [Thu, 7 Jan 2016 17:11:58 +0000 (09:11 -0800)]
Update a utility to support the new tpm sysfs class directory

Kernel TPM patches from 4.x moved /sys/class/misc/tpm0 to /sys/class/tpm/tpm0.
Support both paths in this utility.

BUG=chromium:573368
BRANCH=none
TEST=untested, not sure if this utility is still used.

Change-Id: Ib81476eee4c9de921502a3a47f6990b9e6b1968b
Reviewed-on: https://chromium-review.googlesource.com/320892
Commit-Ready: Bryan Freed <bfreed@chromium.org>
Tested-by: Bryan Freed <bfreed@chromium.org>
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
5 years agoPort to musl: musl doesn't have execinfo.h.
Doug Evans [Thu, 19 Nov 2015 23:57:23 +0000 (15:57 -0800)]
Port to musl: musl doesn't have execinfo.h.

Change-Id: Idc2f18880581d3a2e67185becee8b77cfa5cdf04
Reviewed-on: https://chromium-review.googlesource.com/313388
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot: Change VbExEc implementations to support RO update
Mary Ruthven [Fri, 18 Dec 2015 19:16:02 +0000 (11:16 -0800)]
vboot: Change VbExEc implementations to support RO update

This change will be used to support EC-RO software sync by allowing for
access to the readonly region of firmware. Currently only the writable
section is accessed by vboot using VB_SELECT_FIRMWARE_A and B.

BUG=chrome-os-partner:48703
BRANCH=none
TEST=built on jerry and check that the RO hash can be read and the image
can be updated.
CQ-DEPEND=CL:319185,CL:320425,CL:320598

Change-Id: Ic3942d86b65da3123798cfd11a78056f5dab6699
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/319213
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoInclude <fcntl.h> instead of <sys/fcntl.h>.
Doug Evans [Thu, 19 Nov 2015 23:05:45 +0000 (15:05 -0800)]
Include <fcntl.h> instead of <sys/fcntl.h>.

Musl complains about using sys/fcntl.h, and with -Werror that
gives a compilation failure. Every other file includes <fcntl.h>
so just use that.

Change-Id: Ibc743bbe335e9e9b91da7e4eacc01cc80cd8b35a
Reviewed-on: https://chromium-review.googlesource.com/313419
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Nam Nguyen <namnguyen@chromium.org>
5 years agoUse ${WERROR} consistently.
Doug Evans [Thu, 19 Nov 2015 22:58:25 +0000 (14:58 -0800)]
Use ${WERROR} consistently.

Change-Id: I37b414b030cc69fab2b4feec70b55297dcd5fdb7
Reviewed-on: https://chromium-review.googlesource.com/313198
Commit-Ready: Doug Evans <dje@google.com>
Tested-by: Doug Evans <dje@google.com>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agovboot2: Add try RO software sync flag
Mary Ruthven [Tue, 5 Jan 2016 22:59:05 +0000 (14:59 -0800)]
vboot2: Add try RO software sync flag

This flag will be used by the firmware updater to indicate that RO
software sync should be attempted.

BUG=chrome-os-partner:48703
BRANCH=None
TEST=make runtests

Change-Id: I42090ac47da45c724e66334648ab447ad3c21178
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/320621
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoMove default target up so it's really the default.
Doug Evans [Thu, 19 Nov 2015 22:14:18 +0000 (14:14 -0800)]
Move default target up so it's really the default.

The line
${FUTIL_BIN}: ${UTILLIB21}
was changing the default.

Change-Id: I7988af498c9a9a1981cf2485e4f9d3496412f133
Reviewed-on: https://chromium-review.googlesource.com/313245
Commit-Ready: Bill Richardson <wfrichar@chromium.org>
Tested-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoTest sha-256 with multiple odd-length updates
Randall Spangler [Tue, 15 Dec 2015 19:39:21 +0000 (11:39 -0800)]
Test sha-256 with multiple odd-length updates

This verifies that the VB2 sha-256 library can handle odd-length
updates.

The expected digest  was generated from:
  echo -n 'test1test2test3' | sha256sum

BUG=None
BRANCH=None
TEST=make runtests

Change-Id: Ia7d57322a1a4b10e718c47f1dae38ed244cf8ebc
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/318363
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoAdd BDB library
Randall Spangler [Thu, 10 Dec 2015 23:03:22 +0000 (15:03 -0800)]
Add BDB library

This is a standalone library for verifying the BDB structures in the
common boot flow document, and a bdb_create utility to create test BDB
structures.  Eventually, creating these structures will be rolled into
futility.

BUG=chrome-os-partner:48448
BRANCH=none
TEST=cd bdb && make runtests

Change-Id: Ic57c26ca84137205da3b6c7d532f5324c93b4285
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/317275
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
5 years agoadd error code for screen drawing failure
Daisuke Nojiri [Wed, 2 Dec 2015 20:05:41 +0000 (12:05 -0800)]
add error code for screen drawing failure

This patch adds error code for screen drawing failure.

BUG=none
BRANCH=tot
TEST=Tested on Glados

Change-Id: I04b349fd2c0bc539338b7ee27b8fa9544c85c873
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/315257
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoFix error message for VbGbbReadBmpHeader
Daisuke Nojiri [Wed, 18 Nov 2015 01:44:46 +0000 (17:44 -0800)]
Fix error message for VbGbbReadBmpHeader

BUG=none
BRANCH=tot
TEST=Tested on Jerry

Change-Id: I1ecfd28b4c694e4aa531ed0e77219b2160509bd0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/313744
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agosign_official_build: add a fallback key for standalone accessories
Vincent Palatin [Tue, 17 Nov 2015 19:18:19 +0000 (11:18 -0800)]
sign_official_build: add a fallback key for standalone accessories

The standalone accessories are using a key name like this:
key_<product>.pem or key_<product>.vbprik2
when it doesn't exist, fallback using key.pem or key.vbprik2.

BRANCH=none
BUG=chrome-os-partner:47557
TEST=manual:
./scripts/image_signing/sign_official_build.sh accessory_usbpd ../ec/build/zinger/ec.bin tests/devkeys-acc /tmp/ec-zinger.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin tests/devkeys-acc /tmp/ec-hadoken.TEST.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig ../ec/private/build/hadoken/keyboard_app.bin /tmp /tmp/ec-hadoken.TEST.SIGNED.bin

Change-Id: I68863664bdb9da1695e91b1986f3a0148af7da26
Reviewed-on: https://chromium-review.googlesource.com/312836
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agoGive more screen control to vboot_draw_screen
Daisuke Nojiri [Mon, 16 Nov 2015 19:47:28 +0000 (11:47 -0800)]
Give more screen control to vboot_draw_screen

New devices have Depthcharge render vboot screens by calling
vboot_draw_screen. Thus, display initialization and backlight control should
not be duplicated. This patch prevents VbDisplayScreen from initializing
display and controlling backlight when vboot is rendering screens using GBB.

BUG=chrome-os-partner:43706,chromium:502066
BRANCH=tot
TEST=Tested on Glados

Change-Id: I50cd2decb7065af96779601b12f0fbf2554ff6ed
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/312749
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agocrossystem: Remove savedmem_base and savedmem_size fields
Julius Werner [Fri, 6 Nov 2015 22:28:44 +0000 (14:28 -0800)]
crossystem: Remove savedmem_base and savedmem_size fields

I don't even know what this is. It seems to have marked some kind of
debug buffer provided by H2C BIOS on pre-Daisy Chromebooks and has not
been touched since it was copied in here when crossystem was first
added. I can't find any references in our codebase so I doubt anybody
would miss it. Let's remove it so the '(error)' fields returned there on
any modern Chromebook stop confusing our vendors.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: Ie2baec536b50bb192eb4cd3e48df212cce53561a
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311346
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
5 years agocrossystem: Remove platform_family field
Julius Werner [Fri, 6 Nov 2015 22:22:32 +0000 (14:22 -0800)]
crossystem: Remove platform_family field

This field doesn't seem to be used for anyone and it keeps adding work
for people trying to bring up new platforms. If we ever needed something
like this again, we'd probably prefer to have it in mosys now anyway.
Let's get rid of it.

BRANCH=None
BUG=chromium:551715
TEST=Built for Falco and Jerry.

Change-Id: I6b96e255968fdd22a345d4a75bfdc1e79d3f5896
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/311345
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>
5 years agoUpdate accessories test keys location
Vincent Palatin [Fri, 30 Oct 2015 23:34:37 +0000 (16:34 -0700)]
Update accessories test keys location

Move around the test keys used for standalone accessories signing
unittesting, so they are easier to use.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: I02fcf444ec76bf6ebf6eb477e1236869aa877210
Reviewed-on: https://chromium-review.googlesource.com/309967
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agovboot: Add GBB flag to turn on serial output
Mary Ruthven [Wed, 28 Oct 2015 17:48:59 +0000 (10:48 -0700)]
vboot: Add GBB flag to turn on serial output

Currently this does nothing. This will eventually be used to enable
serial output.

BUG=chromium:210230
BRANCH=none
TEST=none

Change-Id: I5c25fd7406e30b96d12bc4bf8210d3c3f4ae79f1
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/309716
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot_api_kernel: Add new EcVbootDone API
Shawn Nematbakhsh [Wed, 21 Oct 2015 21:31:02 +0000 (14:31 -0700)]
vboot_api_kernel: Add new EcVbootDone API

Add a new post-EC software sync API VbExEcVbootDone() to take actions
which normally need to happen after EC verification / sysjump.

BUG=chromium:537269
TEST=Manual on Glados. Set CHG_MW thresh to 20000, BAT_PCT to 50. Verify
that LIMIT_POWER host event is set until Zinger negotiates to 20V. Also
verify that we do not proceed with boot when Donette is plugged.
BRANCH=None
CQ-DEPEND=CL:307885,CL:309523

Change-Id: I77e6000aa8a44e3aca4fb5982e5b5f5191774989
Signed-off-by: Shawn Nematbakhsh <shawnn@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307952
Commit-Ready: Shawn N <shawnn@chromium.org>
Tested-by: Shawn N <shawnn@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosign_official_build: fix support for signing standalone accessories
Vincent Palatin [Wed, 28 Oct 2015 16:21:43 +0000 (09:21 -0700)]
sign_official_build: fix support for signing standalone accessories

My previous patch using futility to re-sign standalone accessory
firmware images had a mistake in the key directory path : fix it.

Also add RSA-2048 'accessory' keys for signer unit testing.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=run cros-signing unittests (./signing_unittests.py)

Change-Id: Ia2f641c85337c67f81968be4730643a6ad5f22cf
Reviewed-on: https://chromium-review.googlesource.com/309530
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoVbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
Furquan Shaikh [Wed, 28 Oct 2015 20:01:27 +0000 (13:01 -0700)]
VbVerifyMemoryBootImage: Allow integrity-only check in dev mode with
FASTBOOT_FULL_CAP set

This change allows developers to boot dev-signed boot images in
unlocked mode if DEV_BOOT_FASTBOOT_FULL_CAP is set in VbNvStorage or
GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set.

BUG=chrome-os-partner:47002
BRANCH=None
TEST=Compiles successfully. make -j runtests

Change-Id: I56e3879594da1b57051dfe242ff347ac970c96bb
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/309606
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agosign_official_build: add support for signing standalone accessories
Vincent Palatin [Tue, 20 Oct 2015 00:22:07 +0000 (17:22 -0700)]
sign_official_build: add support for signing standalone accessories

Use futility to re-sign standalone accessory firmware images either the
former "usbpd1" used by USB Power Delivery firmware generated from the
EC codebase or the new "rwsig" format.

BRANCH=smaug, samus
BUG=chrome-os-partner:46635
TEST=manual:
openssl genrsa -F4 -out key_zinger.pem 2048
openssl genrsa -F4 -out key_hadoken.pem 2048
futility create --desc="Hadoken fake MP key" key_hadoken.pem key_hadoken
./scripts/image_signing/sign_official_build.sh accessory_usbpd build/zinger/ec.bin . build/zinger/ec.SIGNED.bin
./scripts/image_signing/sign_official_build.sh accessory_rwsig build/hadoken/keyboard_app.bin . build/hadoken/keyboard_app.SIGNED.bin
and compare the re-signed files with the original files.

Change-Id: I586ba3e4349929782e734af1590f394824e7dd44
Reviewed-on: https://chromium-review.googlesource.com/306795
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoSave recovery reason before user three-finger-salutes
Daisuke Nojiri [Wed, 21 Oct 2015 01:31:10 +0000 (18:31 -0700)]
Save recovery reason before user three-finger-salutes

When a user hits esc+refresh+power to start recovery, the true recovery
reason will be lost after reboot. (It would always look like
VB2_RECOVERY_RO_MANUAL.) This patch makes VbBootRecovery save
the reason in the subcode area before entering the new 'broken' loop.

BUG=chromium:501060
BRANCH=tot
TEST=test_that -b veyron_jerry suite:faft_bios

Change-Id: Ib536daa0633721bfc975381782d348f122b3d337
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/307586
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd VbExGetLocalizationCount
Daisuke Nojiri [Wed, 7 Oct 2015 00:03:08 +0000 (17:03 -0700)]
Add VbExGetLocalizationCount

VbExGetLocalizationCount is a callback function which is supposed to
return the number of screen locales supported by VbExDisplayScreen.

After this change, we still try to get the number of locales from GBB
first but when it fails, VbExGetLocalizationCount is called. The error
code from VbGbbReadBmpHeader will be masked, similarly to the error from
VbDislayScreenFromGBB.

BUG=chromium:502066
BRANCH=tot
TEST=Tested on Samus. make runtests

Change-Id: I04ef8bf1ea02b1aaa05e65673b57bcea1932d8b0
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304376
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agofutility: add support for .pem with public key
Vincent Palatin [Fri, 16 Oct 2015 00:54:34 +0000 (17:54 -0700)]
futility: add support for .pem with public key

Add support for PEM file containing a RSA Public key in futility "show"
and "create" commands.

When "futility create" is given a PEM file with only a RSA public key,
generate the proper .vbpubk2 rather than failing.

BRANCH=smaug
BUG=none
TEST=make runtests
and run manually
futility show tests/testkeys/key_rsa4096.pub.pem
futility show tests/testkeys/key_rsa4096.pem

Change-Id: I707ceca54c80ba21f53869ad86c86fa23b31e665
Reviewed-on: https://chromium-review.googlesource.com/306683
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agofutility: fix segfault on short files
Vincent Palatin [Fri, 16 Oct 2015 00:46:58 +0000 (17:46 -0700)]
futility: fix segfault on short files

Verify the size of the buffer read from the file before trying to use 1KB of
it for the new rwsig format detection.

Add a new test case with a short file containing only 4 bytes of unknown
data and run "futility show" on it.

BRANCH=smaug
BUG=none
TEST=futility show foobar.pub.pem
where foobar.pub.pem is a 451-byte file.
check that "make runtests" passes with the fix
and fails without it with the following message :
test_file_types.sh ... failed
FAIL: 13 / 14 passed

Change-Id: Ia9d68c6b528c2b3a595ea6791c907374616d051f
Reviewed-on: https://chromium-review.googlesource.com/306682
Commit-Ready: Vincent Palatin <vpalatin@chromium.org>
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agofutility: Revised support for RO+RW firmware
Bill Richardson [Thu, 15 Oct 2015 07:23:18 +0000 (00:23 -0700)]
futility: Revised support for RO+RW firmware

The "rwsig" type is used for independent device firmware (not
Chromebook BIOS) that need to verify themselves instead of using
software sync.

The expected use case is that a RO firmware contains a
vb2_public_key struct along with an FMAP or other pointers to a
slot for RW firmware. The RW firmware slot reserves room for a
vb2_signature struct.

This CL changes the args and behavior of the rwsig type, so that
the RW firmware can be [re]signed independently of the rest of
the image.

BUG=chrome-os-partner:46254
BRANCH=smaug,ToT
TEST=make runtests, manual

Create a keypair:

  futility create --desc "Key One" tests/testkeys/key_rsa2048.pem foo

Sign a RW binary and build a complete image out of the parts:

  futility sign --type rwsig --prikey foo.vbprik2 rw.bin sig.bin

  dd if=/dev/zero bs=65536 count=1 of=image.bin
  dd if=rw.bin of=image.bin conv=notrunc
  dd if=sig.bin bs=$((65536 - 1024)) seek=1 of=image.bin conv=notrunc

Verify both the separate parts and the combined image:

  futility show --type rwsig --pubkey foo.vbpubk2 rw.bin sig.bin
  futility show --type rwsig --pubkey foo.vbpubk2 image.bin

Re-sign the combined image with a different keypair:

  futility create --desc "Key Two" tests/testkeys/key_rsa1024.pem bar

  futility sign --type rwsig --prikey bar.vbprik2 image.bin

Now the first key no longer verifies:

  futility show --type rwsig --pubkey foo.vbpubk2 image.bin

But the second key does:

  futility show --type rwsig --pubkey bar.vbpubk2 image.bin

Change-Id: Ifdddab08f218f506eb1dce28851b153d70140a7b
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/305980
Tested-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
5 years agoRevert "image_signing: use sparse partition extraction"
Mike Frysinger [Thu, 15 Oct 2015 22:38:36 +0000 (18:38 -0400)]
Revert "image_signing: use sparse partition extraction"

This reverts commit 82dec09bd5098715ddf9cd7d2e4abe87606d5249.

This flag doesn't exist on Ubuntu Precise which is what the signers
are running atm.  Until we get them upgraded to Trusty, back this
change out.

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I9ba508c1531dbb169fd020d06ab102f6576b7342
Reviewed-on: https://chromium-review.googlesource.com/306310
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
5 years agoPass locale to VbExDisplayScreen
Daisuke Nojiri [Tue, 6 Oct 2015 23:50:33 +0000 (16:50 -0700)]
Pass locale to VbExDisplayScreen

This change makes VbDisplayScreen read the last saved locale from nvram
and pass it to VbExDisplayScreen so that it can draw locale dependent
screens.

BUG=chromium:502066
BRANCH=tot
TEST=Tested on Samus. make runtests.
CQ-DEPEND=CL:304382,CL:306100,CL:306110

Change-Id: I9782ec5a8a9f8393998aa8a0d64e88ad1809233b
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304375

5 years agofutility: Support for signing RO+RW firmware
Bill Richardson [Mon, 12 Oct 2015 20:58:12 +0000 (13:58 -0700)]
futility: Support for signing RO+RW firmware

This adds the "rwsig" type, with initial support for RO+RW
firmware images that need to verify themselves instead of using
software sync. This uses our vb2 structs instead of raw binary
blobs. That will help us locate, identify, and verify the keys
and signatures in the signed firmware images.

BUG=chrome-os-partner:46254
BRANCH=smaug,ToT
TEST=make runtests

I also hacked up a test board with the EC-side signature
verification routines from a preliminary CL and tested this
signing scheme with that. It works.

Additional work is needed to make this seamless, but you can try
it out like so:

  futility create ./tests/testkeys/key_rsa2048.pem foo

  futility sign --type rwsig --prikey foo.vbprik2 --pubkey foo.vbpubk2 ec.bin

Change-Id: I876ab312a2b0b36411c5f739fe3252529728d034
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/305394
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd NV flag to default boot legacy OS
Mary Ruthven [Tue, 6 Oct 2015 17:42:31 +0000 (10:42 -0700)]
Add NV flag to default boot legacy OS

In developer mode, this option will make the system try to boot into
a legacy OS first after the 30 second timeout. This removes the need to
press a key during boot to try legacy mode and the need to remove the
write protect screw to boot legacy as default.

BUG=chromium:310697
BRANCH=none
TEST=make runtests

Change-Id: I9a9f64c14ad015e21d08eec36e8fc187189cd2f2
Signed-off-by: Mary Ruthven <mruthven@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/304077
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoAdd broken screen
Daisuke Nojiri [Thu, 30 Apr 2015 19:41:24 +0000 (12:41 -0700)]
Add broken screen

In the new recovery process, a user will see 'broken' screen
instead of 'remove' screen, where usb stick presence is no longer
detected. A user instead has to hit esc+refresh+power to proceed
to recovery mode.

BUG=chromium:501060
BRANCH=tot
TEST=make runtests

Change-Id: Icd511c1ca892628b96befbb0a34c2c84b881c857
Reviewed-on: https://chromium-review.googlesource.com/304404
Commit-Ready: Daisuke Nojiri <dnojiri@chromium.org>
Tested-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agorecovery: Add recovery reason for fastboot mode requested in
Furquan Shaikh [Wed, 19 Aug 2015 04:19:28 +0000 (21:19 -0700)]
recovery: Add recovery reason for fastboot mode requested in
user-mode.

BUG=chrome-os-partner:42674
BRANCH=None
TEST=Compiles successfully and behavior verified.

Change-Id: I67ec056f28596dd0c0005a54e454abe1b4104cfb
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/294276
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
(cherry picked from commit 6d9a9a9fdd3bcdadbfc4f44640da4c462803a69d)
Reviewed-on: https://chromium-review.googlesource.com/304673
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosigner: update legacy bootloader templates after image signing
Amey Deshpande [Thu, 17 Sep 2015 01:16:42 +0000 (18:16 -0700)]
signer: update legacy bootloader templates after image signing

Specifically, this patch updates 'root_hexdigest' in legacy bootloader
templates in EFI system partition to match the signed rootfs.

BRANCH=None
BUG=chromium:512940
TEST=Ran sign_official_build.sh locally and booted the image on kvm
(using BIOS).
TEST=Ran signing_unittests.py by locally changing vboot_stable_hash to
include this patch.

$ ./sign_official_build.sh base chromiumos_base_image.bin \
  ../../tests/devkeys chromiumos_base_image_signed.bin

Change-Id: Ied021c4464b113a64508f5081605069bdcecbc1f
Reviewed-on: https://chromium-review.googlesource.com/301742
Commit-Ready: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agofutility: Add show capability for usbpd1 images
Bill Richardson [Thu, 24 Sep 2015 17:59:41 +0000 (10:59 -0700)]
futility: Add show capability for usbpd1 images

The firmware for the USB Type-C power adapters uses raw binary
blobs for the public keys and signatures instead of
readily-identifiable structs. We've been able to sign these
firmware images for some time, but verifying the result generally
required testing them on hardware.

This CL adds some futilty support for recognizing and verifying
those images too. It just tries various sig and hash algorithms,
until it finds a combination for which the image is
self-consistent (where the pubkey blob verifies the signature
blob).

BUG=none
BRANCH=none
TEST=make runtests

This change also adds additional tests for usbpd1 images. We
ensure that we correctly recognize and verify an MP-signed
firmware, plus test signing and verifying usbpd1 images using
multiple signature and hash algorithms.

Change-Id: I4fbe8b37a694992f635d5469ae1c2449b1610dfd
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/302415
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot: Move GPT entry operator functions to gpt_misc
Furquan Shaikh [Tue, 22 Sep 2015 16:09:27 +0000 (09:09 -0700)]
vboot: Move GPT entry operator functions to gpt_misc

This is to allow external entities using vboot library
(e.g. depthcharge) to utilize these operator functions to perform get
/ set operations on GPT entry.

BUG=chrome-os-partner:45670
BRANCH=None
TEST=Compiles successfully "sudo emerge vboot_reference" "emerge-smaug
vboot_reference". "make -j runtests" successful.

Change-Id: I9e34a2a7afeae6293a78424794797d5755950888
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/301475
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot2: tpm error doesn't block gbb dev flag
Randall Spangler [Thu, 17 Sep 2015 22:50:48 +0000 (15:50 -0700)]
vboot2: tpm error doesn't block gbb dev flag

In recovery mode, the TPM may be bad / corrupt.  This prevents access to
the soft developer switch stored in secdata.  But it should not prevent
setting dev mode via GBB or context flags.  Those flags may be set
during manufacturing or testing, and override the contents of secdata
anyway.

BUG=chrome-os-partner:45511
BRANCH=ryu
TEST=make runtests

Change-Id: I242714528203cc7cf78a714c660b7f8bbd0e04d0
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/300621
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agosign_official_build: support signing 'recovery_kernel' image type
Furquan Shaikh [Fri, 11 Sep 2015 23:05:37 +0000 (16:05 -0700)]
sign_official_build: support signing 'recovery_kernel' image type

BRANCH=None
BUG=chrome-os-partner:44227
TEST='sign_official_build.sh recovery_kernel boot.img keys
boot.img.recovery-signed' works fine and able to boot in locked recovery mode
using fastboot boot.

Change-Id: Iabde28bb2068b8294fc3d03f2f771c63368ecbb5
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/300250
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agovboot2: Support reboot requested by secdata
Randall Spangler [Thu, 17 Sep 2015 19:54:51 +0000 (12:54 -0700)]
vboot2: Support reboot requested by secdata

When a TPM goes from the disabled state to the enabled state, it must
reboot after being enabled, before it can be initialized.  In vboot1,
TLCL was part of vboot and this was handled internally.  In vboot2, the
caller must set a context flag, so that vboot can decide whether to
allow the reboot, or whether to go directly to recovery mode.  This
check is necessary to handle the following cases:

1) The device is booting normally, but the TPM needs a reboot.  This
should simply reboot, without going to recovery mode.

2) The device is booting in recovery mode, but the TPM needs a reboot.
If this is the first time it asked us, allow the reboot.

3) The TPM asked for a reboot last time, so we did.  And it's still
asking.  Don't reboot, because that runs the risk that whatever is wrong
won't be fixed next boot either, and we'll get stuck in a reboot loop
that will prevent recovery.  Boot into recovery mode.

Add a new NvStorage bit to track whether the TPM requested a reboot on
the previous boot.  That's better than what we did in vboot1, where we
used a special recovery request.  Vboot1 couldn't track getting stuck in
a reboot loop in normal mode, only in recovery mode.  The new code can
catch both.

BUG=chrome-os-partner:45462
BRANCH=ryu
TEST=make runtests

Change-Id: I2ee54af107275ccf64a6cb41132b7a0fc02bb983
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/300572
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agocrossystem: Updated crossystem to accomodate Android
Shelley Chen [Mon, 14 Sep 2015 22:39:29 +0000 (15:39 -0700)]
crossystem: Updated crossystem to accomodate Android
(resubmit)

Previously crossystem assumed that mosys was located
in /usr/sbin.  In Android mosys is currently located
in /system/bin.  Using fixed paths as opposed to
'which' to prevent attacks where attacker could insert
mosys in PATH.

difference from previous commit:
  Removed the allocation of duplicate arrays.  Kept
  with simplicity of original version, just returning
  correct constant depending on detected platform.

BUG=chromium:527484
BRANCH=none
TEST=ran crossystem, crossystem fw_try_count/
fw_try_next, crossystem fw_try_count/fw_try_next=x
on smaug and daisy.

Change-Id: I923206db1411a9a35c9c8e3f9ede5016f49b5f26
Signed-off-by: Shelley Chen <shchen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/299801
Reviewed-by: danny chan <dchan@chromium.org>
5 years agoimage_signing: use sparse partition extraction
Mike Frysinger [Thu, 10 Sep 2015 20:18:03 +0000 (16:18 -0400)]
image_signing: use sparse partition extraction

Often the partitions we extract have extra space in them, but the dd
utility will still write out the excess zeros.  That can mean we write
out hundreds of megs of data which could otherwise be skipped.  We thus
waste a good amount of I/O and storage.

For now, only use this flag when extracting a partition to a new file
as this should be safe (there's no pre-existing data to clobber/merge).

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: Ic32665cf7c38fc0a5efc3f8b227fa8ff408ca9e3
Reviewed-on: https://chromium-review.googlesource.com/299450
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agoimage_signing: use sparse copying when creating the signed image
Mike Frysinger [Wed, 9 Sep 2015 21:00:57 +0000 (17:00 -0400)]
image_signing: use sparse copying when creating the signed image

This should speed up the copies significantly by using less disk
storage & I/O when the unpacked file is not sparse already.  This
option has been in cp for a long time, and works in Ubuntu Precise
(coreutils-8.13) & Trusty (coreutils-8.21).

BUG=chromium:530730
TEST=`./signing_unittests.py` passes
BRANCH=None

Change-Id: I82192455a623eabf96abf4f25296f3dc0c129ca2
Reviewed-on: https://chromium-review.googlesource.com/299440
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Reviewed-by: Amey Deshpande <ameyd@google.com>
5 years agoimage_signing: do not delete output when signing loem firmware
Mike Frysinger [Thu, 10 Sep 2015 20:29:34 +0000 (16:29 -0400)]
image_signing: do not delete output when signing loem firmware

Rather than use the existence of the output as a marker for running the
gbb step, key off the loem index.  We want to run it the first time and
not bother after that.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=signer can still sign loem keysets

Change-Id: I26e9ccaf1333f769d6993a8e0d84c63644bb2597
Reviewed-on: https://chromium-review.googlesource.com/298980
Reviewed-by: David Riley <davidriley@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
5 years agosigner: create devkeys with and without pkc
David Riley [Tue, 8 Sep 2015 20:05:56 +0000 (13:05 -0700)]
signer: create devkeys with and without pkc

Signing test of firmware for non-t210 targets fails when PKC
keys are present so separate devkeys into two keysets where only
one has the PKC key.

BUG=chrome-os-partner:44227
TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys-pkc tegra_lp0_resume.fw.signed versions.default
BRANCH=signer

Change-Id: Ie0670638d30d17692f1113b5a9f0309ea610d72a
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/298091
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agokeygeneration: fix some portability aspects
Mike Frysinger [Wed, 8 Apr 2015 17:43:01 +0000 (13:43 -0400)]
keygeneration: fix some portability aspects

The "function" keyword is not portable -- use the normal function style.

The awk command uses a non-portable regex (the word anchor \>).  Rework
it to avoid regexes entirely.

BUG=chromium:475101
TEST=keyset_version_check.sh works on a POSIX system
BRANCH=None

Change-Id: I5446f63aa9181d06da1898aafb8fab17f5042989
Reviewed-on: https://chromium-review.googlesource.com/296562
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agosigner: Add signing support for nvidia lp0 firmware from signer
David Riley [Fri, 4 Sep 2015 23:05:06 +0000 (16:05 -0700)]
signer: Add signing support for nvidia lp0 firmware from signer

Signer was calling sign_official_build.sh in a manner that wasn't
being accepted correctly.  Also add test keys from firmware branch.

BUG=chrome-os-partner:44227
TEST=sign_official_build.sh nv_lp0_firmware tegra_lp0_resume.fw tests/devkeys tegra_lp0_resume.fw.signed versions.default
BRANCH=signer

Change-Id: Icd298ac75e3da746220826dc2fb9cc2466e41f1d
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/297802
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agoimage_signing: rework input/output files and firmware signing
Mike Frysinger [Fri, 4 Sep 2015 23:37:12 +0000 (19:37 -0400)]
image_signing: rework input/output files and firmware signing

The new nvidia logic expects to have the "real" output filename and not
yet another temp path.  Since sign_firmware.sh supports being passed in
the input as the output and doing in-place signing, just document it and
update the callers.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=signer outputs pubkey.sha to the same location as the output firmware

Change-Id: Iadc5dc5aaace6be9e22ff2c55bfbc58b7e1b3ef0
Reviewed-on: https://chromium-review.googlesource.com/296574
Commit-Ready: Mike Frysinger <vapier@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
5 years agosigner: Add signing support for nvidia lp0 firmware
Furquan Shaikh [Tue, 1 Sep 2015 07:11:35 +0000 (00:11 -0700)]
signer: Add signing support for nvidia lp0 firmware

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine.

Change-Id: I7d623a22d73a1749ebebd323fe09cbbeb8cbd61e
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296429
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agosign_firmware: Add nv_pkc_signing step if required
Furquan Shaikh [Mon, 31 Aug 2015 18:30:42 +0000 (11:30 -0700)]
sign_firmware: Add nv_pkc_signing step if required

If nv_pkc.pem file is present for a device, use nv_pkc_signing for
adding PKC signature in the firmware image.

BUG=chrome-os-partner:44227
BRANCH=None
TEST=unittests run fine. verified image boots on fused system.

Change-Id: I9b2f48da55137a0e4a75f23d16d3779be1aa94c8
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/296452
Commit-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agoVBOOT2: Add work buffer too small error message
Lee Leahy [Wed, 26 Aug 2015 22:56:05 +0000 (15:56 -0700)]
VBOOT2: Add work buffer too small error message

Update VBOOT2 to add work buffer too small error message.

BRANCH=none
BUG=None
TEST=Build and run on kunimitsu

Change-Id: Icb4b873e0c350a5667948e106c111356acab6a82
Signed-off-by: Lee Leahy <Leroy.P.Leahy@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/295753
Commit-Ready: Leroy P Leahy <leroy.p.leahy@intel.com>
Tested-by: Leroy P Leahy <leroy.p.leahy@intel.com>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoRevert "crossystem: Updated crossystem to accomodate Android"
Eric Caruso [Sat, 22 Aug 2015 00:22:29 +0000 (00:22 +0000)]
Revert "crossystem: Updated crossystem to accomodate Android"

This reverts commit 26825b53dc914e4599767ae1e78fe731840027c1.

This looks like it breaks ARM systems by causing crossystem to crash freeing stuff.

BUG=chromium:523189

Change-Id: Ic1e1594519354e7b80424f5c66dc9bdb2605ec73
Reviewed-on: https://chromium-review.googlesource.com/295215
Reviewed-by: Eric Caruso <ejcaruso@chromium.org>
Commit-Queue: Eric Caruso <ejcaruso@chromium.org>
Tested-by: Eric Caruso <ejcaruso@chromium.org>
5 years agosign_official_build: support signing 'kernel' image type
David Riley [Fri, 21 Aug 2015 07:57:38 +0000 (00:57 -0700)]
sign_official_build: support signing 'kernel' image type

BRANCH=signer
BUG=chrome-os-partner:44227
TEST='sign_official_build.sh kernel boot_devsigned.img keys boot_resigned.img'

Change-Id: I805231ef4bd4ed86b35c0d7ca2d3fe1e704caabc
Signed-off-by: David Riley <davidriley@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/294954
Reviewed-by: Mike Frysinger <vapier@chromium.org>
5 years agocrossystem: Updated crossystem to accomodate Android
Shelley Chen [Mon, 10 Aug 2015 18:24:36 +0000 (11:24 -0700)]
crossystem: Updated crossystem to accomodate Android

Previously crossystem assumed that mosys was located
in /usr/sbin.  In Android mosys is currently located
in /system/bin.  Using fixed paths as opposed to
'which' to prevent attacks where attacker could insert
mosys in PATH.

BUG=none
BRANCH=none
TEST=ran crossystem, crossystem fw_try_count/
fw_try_next, crossystem fw_try_count/fw_try_next=x
on link and smaug.

Change-Id: I9604f008d457147188dc852c173d5a184163b339
Signed-off-by: Shelley Chen <shchen@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/292314
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agosign_official_build: support signing 'base' image type
Amey Deshpande [Fri, 14 Aug 2015 21:51:21 +0000 (14:51 -0700)]
sign_official_build: support signing 'base' image type

BRANCH=signer
BUG=chromium:512940
TEST=Tested with the following command:

$ ./sign_official_build.sh base chromiumos_base_image.bin ../../tests/devkeys \
    chromiumos_base_image_signed.bin ../../tests/devkeys/key.versions

Change-Id: Ife2284a6ca82f4306ca26278159859928c0ff2b5
Reviewed-on: https://chromium-review.googlesource.com/293636
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Tested-by: Amey Deshpande <ameyd@google.com>
Commit-Queue: Amey Deshpande <ameyd@google.com>

5 years agoAdd "tpmc pcrextend" command to extend a PCR
Kevin Cernekee [Wed, 29 Jul 2015 00:25:04 +0000 (17:25 -0700)]
Add "tpmc pcrextend" command to extend a PCR

This is useful for testing different configurations without repeatedly
reflashing the firmware, e.g.

    # stop tcsd
    # tpmc pcr 0
    0000000000000000000000000000000000000000
    # tpmc pcrextend 0 c42ac1c46f1d4e211c735cc7dfad4ff8391110e9
    # tpmc pcr 0
    865aedd337518e56f648440b81b4cbd9359fdff3
    <reboot and try another value>

BUG=none
BRANCH=none
TEST=manual

Change-Id: Ie5814ca2a3a5cf5a0eaf0ffee0385315db09bf25
Signed-off-by: Kevin Cernekee <cernekee@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/289009
Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
5 years agoVbNvStorage: Add flags for misc settings
Furquan Shaikh [Thu, 30 Jul 2015 20:38:24 +0000 (13:38 -0700)]
VbNvStorage: Add flags for misc settings

1. Change offset 8 to hold all misc settings (fastboot, boot_on_ac
detect) instead of only fastboot settings.
2. Add flag to hold state of boot_on_ac_detect (If set to 1, AP should
start booting as soon as AC is connected in off-state).

BUG=chrome-os-partner:41680
BRANCH=None
TEST=Compiles successfully. make runtests successful.

Change-Id: I64b3fc69bd52cbcaf5899c953ccafa2e81b5b8a5
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/289900
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Vincent Palatin <vpalatin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agofutility: Compute / verify root key hash
Randall Spangler [Fri, 17 Jul 2015 16:44:29 +0000 (09:44 -0700)]
futility: Compute / verify root key hash

Ryu will store a hash of the GBB root key in a struct inside its boot
block.  Add a vb2_ryu_root_key_hash struct for that.

If 'futility gbb_utility' is used to set the root key, also look for a
root key hash struct and fill it in.  No error if not found, because
this needs to work on other platforms where the struct is not present.
This way, we don't need to change the signing scripts.

Added a --roothash option which can be used to check if the root key
hash is found, and if so, whether it's empty, valid, or invalid.

BUG=chromium:511405
BRANCH=ryu
TEST=manual

    Take any existing image.bin.
    cp image.bin image.orig

    gbb_utility --roothash image.bin
    - ryu root hash not found

    Extract the root key
    gbb_utility -k rootkey.bin image.bin
    - exported root_key to file: rootkey.bin

    Now, append a blank ryu root hash struct to it
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    Nothing is set yet
    gbb_utility --roothash image.bin
    - ryu root hash is unset

    Setting the root key also sets the root hash
    gbb_utility -s -k rootkey.bin image.bin
    - import root_key from rootkey.bin: success
    - calculate ryu root hash: success
    successfully saved new image to: image.bin

    See, it verifies
    gbb_utility --roothash image.bin
    - ryu root hash verified

    Now, append a bad ryu root hash struct to it
    cp image.orig image.bin
    echo '0000000: 5274 4b79 4861 7368 0100 0000 3000 0000' | xxd -r >> image.bin
    echo '0000000: 0001 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin
    echo '0000000: 0000 0000 0000 0000 0000 0000 0000 0000' | xxd -r >> image.bin

    See, it fails
    gbb_utility --roothash image.bin
    - ryu root hash does not verify

    Make sure the library doesn't contain the magic string
    strings `which futility` | grep RtKyHash
    (should be no output)

Change-Id: Ib46f93cac0f2b532bada4b187ae48efcf4926702
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286237
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
5 years agocrossystem: Add Skylake PCH GPIO controller ID
Duncan Laurie [Tue, 21 Jul 2015 03:01:34 +0000 (20:01 -0700)]
crossystem: Add Skylake PCH GPIO controller ID

Add the GPIO controller ID that is used in the Skylake PCH
so it can properly export and use GPIOs that are exported
in VBNV for write protect.

BUG=chrome-os-partner:42560
BRANCH=none
TEST=verify crossystem output with and without WP enabled

Change-Id: Ic85c202bd0ca15c154c10481926ef18bafe3fac5
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286827
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agoimage_signing: Add more description to set_gbb_flags.
Hung-Te Lin [Thu, 16 Jul 2015 10:04:00 +0000 (18:04 +0800)]
image_signing: Add more description to set_gbb_flags.

There are two new GBB flags added (lid/fastboot) and we should update the
description in set_gbb_flags.

BRANCH=none
BUG=none
TEST=emerge-link vboot_reference

Change-Id: I0d16df03e9427ec1c8780fbb6be10c31eed9bf9e
Signed-off-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286052
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agocrossystem: Add skylake platform IDs
Duncan Laurie [Tue, 21 Jul 2015 00:05:52 +0000 (17:05 -0700)]
crossystem: Add skylake platform IDs

Add the skylake-u and skylake-y vendor/device IDs so it can be
reported by crossystem.

BUG=chrome-os-partner:42560
BRANCH=none
TEST=run "crossystem platform_family" on glados

Change-Id: I5f9b92d404166e56d77cf8b0cd627a3a0b63bedf
Signed-off-by: Duncan Laurie <dlaurie@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/286921
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
5 years agocrossytem:Fix the write protect line gpio value
John Zhao [Thu, 2 Apr 2015 17:24:51 +0000 (10:24 -0700)]
crossytem:Fix the write protect line gpio value

For crossystem to work correctly on Strago/Cyan,
add Braswell string and correct GPIO offset
calculations.
In Braswell, write protect line is MF_ISH_GPIO_4
as encoded as 0x10016 where the GPEAST offset
(COMMUNITY_OFFSET_GPEAT) is 0x10000

BUG=chrome-os-partner:40835
BRANCH=None
TEST=test_that -b <strago/cyan> <IP> platform_Crossystem

Change-Id: I365f3d6ca9f3ac7ef50abb9b2ba13f184d39c100
Signed-off-by: John Zhao <john.zhao@intel.com>
Signed-off-by: Arindam Roy <arindam.roy@intel.com>
Reviewed-on: https://chromium-review.googlesource.com/274841
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Commit-Queue: Bernie Thompson <bhthompson@chromium.org>

5 years agocrossystem: Revise description of sw_wpsw_boot.
Hung-Te Lin [Thu, 9 Jul 2015 06:53:33 +0000 (14:53 +0800)]
crossystem: Revise description of sw_wpsw_boot.

The sw_wpsw_boot was made for some feature that was almost never completed, and
only makes sense on Baytrail platforms. To prevent confusion we should address
that in the crossystem description.

BRANCH=none
BUG=chromium:508269
TEST=make test

Change-Id: I1fbc7a0e9e8c1f8503ae8ae9dfb6e80c8da892e3
Reviewed-on: https://chromium-review.googlesource.com/284425
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Commit-Queue: Hung-Te Lin <hungte@chromium.org>

5 years agocrossystem: Add check for "mkbp" back
David Hendricks [Mon, 29 Jun 2015 22:05:58 +0000 (15:05 -0700)]
crossystem: Add check for "mkbp" back

We may have been over-zealous earlier when trying to eliminate
references to mkbp. Since crossystem runs on all ChromeOS devices,
this re-adds "mkbp" back to mitigate the risk of encountering
problems on systems running newer versions of ChromeOS but with
older firmware.

BUG=chrome-os-partner:21097
BRANCH=none
TEST=Compiled for veyron_brain

Change-Id: Ia0086687fbc3a1195b062367ccb6ee5c41acd026
Signed-off-by: David Hendricks <dhendrix@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/282602
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agocrossystem: Check for "cros-ec" instead of "mkbp" for *NvStorage
David Hendricks [Tue, 26 May 2015 23:48:39 +0000 (16:48 -0700)]
crossystem: Check for "cros-ec" instead of "mkbp" for *NvStorage

This changes the string we look for in the devicetree on ARM
platforms to look for "cros-ec" (DT uses dashes instead of
underscores) instead of "mkbp".

BUG=chrome-os-partner:21097
CQ-DEPEND=CL:273347
BRANCH=none
TEST=with depthcharge patch applied, ran crossystem on newly
booted system and saw VBNV-related variables turn out the same.

Signed-off-by: David Hendricks <dhendrix@chromium.org>
Change-Id: Iac43f5381327eb878a8d0db606b78bb7bdce816f
Reviewed-on: https://chromium-review.googlesource.com/273391
Commit-Queue: Stefan Reinauer <reinauer@chromium.org>
Tested-by: Stefan Reinauer <reinauer@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
5 years agorecovery: Add recovery reason for fastboot mode requested in fw
Furquan Shaikh [Sat, 20 Jun 2015 21:17:42 +0000 (14:17 -0700)]
recovery: Add recovery reason for fastboot mode requested in fw

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully

Change-Id: Ic69834f2e23926e618349b5a56db549a290cd0c2
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/280922
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agocgpt repair: fix segfault which occurs when one of the headers is bad
Andrey Ulanov [Thu, 11 Jun 2015 03:02:06 +0000 (20:02 -0700)]
cgpt repair: fix segfault which occurs when one of the headers is bad

When one of GPT headers is invalid the corresponding partition table
is not loaded and corresponding pointers in GptData are NULL.
GptRepair will try to memcpy one entries table to another which
results in SIGSEGV.

This change fixes it by freeing and then reallocating bad copy of
partition table. This potentially fixes problems which would occur
if two tables have different size.

Change that initially introduced this problem by not always allocating
secondary_entries:
https://chromium-review.googlesource.com/223800

TEST="cgpt repair" works where it previously didn't
TEST=make runtests
BUG=brillo:1203
BRANCH=none

Change-Id: Ibb2fcf33faa5ba157b0865d04c90ee3f26eee113
Reviewed-on: https://chromium-review.googlesource.com/276766
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Andrey Ulanov <andreyu@google.com>
Tested-by: Andrey Ulanov <andreyu@google.com>
5 years agovboot_reference: fix unittest when building with clang.
Yunlian Jiang [Tue, 9 Jun 2015 23:21:56 +0000 (16:21 -0700)]
vboot_reference: fix unittest when building with clang.

When linking vboot_api_kernel4_tests, there are two VbBootNormal()
available, the gcc chooses the one in vboot_api_kernel4_tests.c and
the test passes, the clang chooses the one in vboot_api_kernel.c and
make the unittest fail. This CL makes the one in vboot_api_kernel.c
a weak symbol so that clang can choose the one in
vboot_api_kernel4_tests.c

BUG=chromium:498469
BRANCH=none
TEST=CC=x86_64-cros-linux-gnu-clang  FEATURES='test'
     emerge-amd64-generic vboot_reference

Change-Id: Ibcb78ee055fc9485dbc2bcc1d1cf98144a1a3b64
Reviewed-on: https://chromium-review.googlesource.com/276504
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
5 years agovboot2: Add 2.0 api layer to verify kernel partition
Randall Spangler [Tue, 19 May 2015 20:41:09 +0000 (13:41 -0700)]
vboot2: Add 2.0 api layer to verify kernel partition

This allows the caller to load the kernel partition and then pass it
to vboot for verification, rather than having vboot assume the kernel
partitions are all on a block storage device.

Next up, APIs for the caller to parse partition information from a GPT
(yes, that's cgptlib, but we'll make it more easily callable by
depthcharge).

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: I388085c7023f4c76d416f37df0607019bea844ac
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/275646
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
5 years agorecovery: Add recovery reasons for BCB
Furquan Shaikh [Thu, 4 Jun 2015 16:07:49 +0000 (09:07 -0700)]
recovery: Add recovery reasons for BCB

BCB is bootloader control block. Add reasons specific to BCB:
1. In case of any error reading/writing BCB (internal FW error)
2. User-mode requested recovery via BCB (user-mode requested)

BUG=chrome-os-partner:40960
BRANCH=None
TEST=Compiles successfully

Change-Id: I0ac362ba7267a08313cb3077be686aa73367e53b
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/275222
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agovboot2: Add routines to load kernel preamble
Randall Spangler [Fri, 29 May 2015 17:53:11 +0000 (10:53 -0700)]
vboot2: Add routines to load kernel preamble

The kernel data itself will be read and verified by a subsequent
change.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: Ife4f8250493ec6457f91fda57ae8d4d7bf18ec89
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/274038
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agocgpt: Add a callback to allow override of GPT entry priority
Furquan Shaikh [Tue, 2 Jun 2015 17:32:52 +0000 (10:32 -0700)]
cgpt: Add a callback to allow override of GPT entry priority

This can be used by implementations that want to request vboot to
favor a particular kernel entry for booting without affecting the
checks for rollback protection and image verification.

CQ-DEPEND=CL:274716, CL:274932, CL:275171
BUG=None
BRANCH=None
TEST=Compiles successfully. make -j runtests successful.

Change-Id: I6a4600020354f5d4118c17f083c353c2585c4181
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/274558
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Stefan Reinauer <reinauer@chromium.org>
Tested-by: Nicolas Boichat <drinkcat@chromium.org>
Commit-Queue: Nicolas Boichat <drinkcat@chromium.org>
Trybot-Ready: Nicolas Boichat <drinkcat@chromium.org>

5 years agovboot_api_kernel: Do not pre-populate variables in
Furquan Shaikh [Sat, 30 May 2015 01:00:46 +0000 (18:00 -0700)]
vboot_api_kernel: Do not pre-populate variables in
VbVerifyMemoryBootImage

Do not use values from the header or preamble until it is known to be
good.

BUG=None
BRANCH=None
TEST=Compiles successfully and VbVerifyMemoryBootImage returns early
for images with bad values in header.

Change-Id: Ic026f49292a139e0a04c2556ca9fa62ff277b18f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/274141
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agovboot2: secdata: Check struct_version on initialization
Julius Werner [Fri, 29 May 2015 23:56:20 +0000 (16:56 -0700)]
vboot2: secdata: Check struct_version on initialization

This patch reintroduces a vb2_secdata->struct_version check similar to
the one that was removed in CL:244846. The CRC is not a reliable way to
detect zeroed buffers, so this check helps vboot fail earlier and more
clearly in certain situations.

BRANCH=kitty,smaug,storm,veyron
BUG=chrome-os-partner:40778
TEST=make runtests. Rebooted Jerry with 'mem w 0xff7601b0 0xfdb9', saw
that recovery reason was now 0x2b (VBNV_RECOVERY_VB2_SECDATA_INIT).

Change-Id: Ic4376d127e6d14d4ef9c2f53c83090040ca4cb68
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/274138
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Reviewed-by: Vadim Bendebury <vbendeb@chromium.org>
5 years agofastboot: Add routines for unlock and lock device
Furquan Shaikh [Tue, 26 May 2015 04:49:11 +0000 (21:49 -0700)]
fastboot: Add routines for unlock and lock device

Add support for functions to request unlock and lock of devices in
response to fastboot oem unlock/lock commands. Unlock operation is
equivalent to enabling dev mode and lock operation is equivalent to
leaving dev mode. It is the responsibility of the caller to ensure
that user confirmation is obtained before unlock/lock operations.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully and fastboot lock/unlock operations work as
expected on smaug. Added tests to ensure lock/unlock operations are
covered. Verified using make -j runtests.

Change-Id: Ibafe75abdd1202473009208a414f3996d537db4f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273182
Reviewed-by: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agofastboot: Add fastboot related flags to vb2
Furquan Shaikh [Tue, 26 May 2015 04:48:02 +0000 (21:48 -0700)]
fastboot: Add fastboot related flags to vb2

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully.

Change-Id: I4305436b2ae46254e4e8b12039ffed95634d62c2
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273181
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agofastboot: Add fastboot related flags to nvstorage
Furquan Shaikh [Tue, 26 May 2015 04:46:10 +0000 (21:46 -0700)]
fastboot: Add fastboot related flags to nvstorage

Use unused offset 8 for fastboot related flags.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully.

Change-Id: I6df0985924ba80cdcb68bb6b7658bf962f01287f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/273180
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>

5 years agoProvide a way to disable counting failed boots
Patrick Georgi [Tue, 10 Feb 2015 13:58:28 +0000 (14:58 +0100)]
Provide a way to disable counting failed boots

When the lid is closed and external power is applied
the system may boot and shut down faster than required
for the OS to determine that things were alright.

In timed charging setups this led to systems ending up
to consider the current version broken because it "failed"
repeatedly.

Remain generic about the reason for not counting boots
since there may be more situations in which we want to
handle the situation optimistically.

BRANCH=none
BUG=chromium:446945
TEST=none

Change-Id: Iea350e3c98d5c00156da682e52c90a882ba017c0
Signed-off-by: Patrick Georgi <pgeorgi@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/249150
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agofastboot: Add routine for verifying kernel image loaded in memory
Furquan Shaikh [Thu, 21 May 2015 21:39:11 +0000 (14:39 -0700)]
fastboot: Add routine for verifying kernel image loaded in memory

This API allows fastboot boot from memory command to verify that the
image loaded in memory is signed properly using recovery keys. Thus,
only officially signed recovery images can be booted using fastboot
boot command in recovery mode.

However, if GBB_FLAG_FORCE_DEV_BOOT_FASTBOOT_FULL_CAP is set, then
this routine will not perform any check and return okay for any image
sent by fastboot boot.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully. With GBB override for FASTBOOT_FULL_CAP
set any signed image is allowed to boot. With FASTBOOT_FULL_CAP not
set, then only officially signed image is allowed to boot. (make -j
runtests successful)

Change-Id: I78028853bd1ad09d3c610a687f327560557d5681
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/272696
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
5 years agosign_official_build: preserve /boot for legacy BIOS
Amey Deshpande [Thu, 21 May 2015 21:46:06 +0000 (14:46 -0700)]
sign_official_build: preserve /boot for legacy BIOS

This patch checks for 'cros_legacy' in the kernel config, and skips
running strip_boot_from_image.sh if present.  This is because
'cros_installer postinst' on legacy BIOS relies on presence of /boot in
rootfs.

BRANCH=signer
BUG=b:20947354
TEST=Ran the script with devkeys, and checked presence of /boot in the
signed .bin file by mounting locally

$ ./sign_official_build.sh ssd chromiumos_image.bin ../../tests/devkeys \
    chromiumos_image_signed.bin ../../tests/devkeys/key.versions

Change-Id: Ieb919067b353839019bc1c561d7bb66bebac1040
Reviewed-on: https://chromium-review.googlesource.com/272742
Tested-by: Amey Deshpande <ameyd@google.com>
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Amey Deshpande <ameyd@google.com>

5 years agovboot2: Add routines to load and verify kernel keyblock
Randall Spangler [Thu, 21 May 2015 00:22:17 +0000 (17:22 -0700)]
vboot2: Add routines to load and verify kernel keyblock

These are slightly more complex than the firmware versions, because
they need to deal with developer-signed keyblocks and keyblock flags.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: I682c14ddfe729984f2629dfbe66750e5cd5ab75e
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/272541
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
5 years agovboot2: Split keyblock checking and signature validation
Randall Spangler [Tue, 19 May 2015 19:45:20 +0000 (12:45 -0700)]
vboot2: Split keyblock checking and signature validation

This is necessary for the next change, which adds keyblock hash checking.

Also clean up some other assorted comments, and move the diagnostic
check of root key to see if it's the checked-in one earlier in
firmware preamble validation so it's closer to where the root key is
loaded.

No functional or higher-level API changes; just shuffling around code
under the covers.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: Ibc3960a4d882dc2ad8684e235db4b9d066eac080
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/272223
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agovboot2: Add routine to verify kernel preamble
Randall Spangler [Tue, 12 May 2015 23:39:01 +0000 (16:39 -0700)]
vboot2: Add routine to verify kernel preamble

This also checks that the bootloader and vmlinuz headers, if present,
are within the signed part of the kernel blob; the vboot1 routines
didn't do that.  That wasn't harmful at firmware boot time because the
vboot1 routines would only load as much data as was signed, but in
vboot2 loading the kernel data is the responsibility of the caller so
we need to check.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: I73eb4831e5d3d7a642b6cb85cb55857d87fcc0af
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270797

5 years agoGBB: Add missing flag LID_SHUTDOWN to vb2_gbb_flag structure
Furquan Shaikh [Sat, 16 May 2015 01:15:18 +0000 (18:15 -0700)]
GBB: Add missing flag LID_SHUTDOWN to vb2_gbb_flag structure

BUG=None
BRANCH=None
TEST=Compiles successfully

Change-Id: I80a501efc3940ca5657dc143c0ab3c6b020dc1e0
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/271620
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>

5 years agoGBB: Add flag for forcing full fastboot capability in firmware
Furquan Shaikh [Fri, 15 May 2015 07:44:41 +0000 (00:44 -0700)]
GBB: Add flag for forcing full fastboot capability in firmware

This flag is equivalent to FORCE_DEV_BOOT_USB. It allows full fastboot
capability in firmware for developer mode.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully for smaug.

Change-Id: I82a2ebe7a8b3bbf38694ab81ca2678624f77fca1
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/271410
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
5 years agonvstorage: Add new flag VBNV_DEV_BOOT_FASTBOOT_FULL_CAP
Furquan Shaikh [Thu, 14 May 2015 19:53:19 +0000 (12:53 -0700)]
nvstorage: Add new flag VBNV_DEV_BOOT_FASTBOOT_FULL_CAP

Add a new flag to nvstorage for controlling fastboot capabilities
offered in firmware in dev-mode. By default, value of this flag would
be ignored in normal mode. Thus, when fastboot-based recovery is
entered from normal mode, only limited capability would be available
in firmware.

After switching to dev-mode, this flag can be set automatically by
user script after performing the wipe or it can be set manually using
crossystem. When fastboot-based recovery is entered from dev mode and
this flag is set, it will provide full fastboot capability in the
firmware.

BUG=chrome-os-partner:40196
BRANCH=None
TEST=Compiles successfully for smaug. make runalltests successful.

Change-Id: I761a9ab304dd90f0b73081acc9ce1f8d9052325f
Signed-off-by: Furquan Shaikh <furquan@google.com>
Reviewed-on: https://chromium-review.googlesource.com/271369
Reviewed-by: Aaron Durbin <adurbin@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Furquan Shaikh <furquan@chromium.org>
Trybot-Ready: Furquan Shaikh <furquan@chromium.org>
Tested-by: Furquan Shaikh <furquan@chromium.org>
5 years agochromeos-tpm-recovery: Convert to manual TPM reset script for developers
Julius Werner [Tue, 6 Jan 2015 18:02:46 +0000 (10:02 -0800)]
chromeos-tpm-recovery: Convert to manual TPM reset script for developers

chromeos-tpm-recovery has not been used for anything in forever (see
CL:238236), but it is still installed on every image. Resetting the TPM
(e.g. to resolve rollback issues when reflashing an MP-signed device to
dev firmware) is a common request by developers, and I get tired of
always digging out the required tpmc commands manually again. Let's
repurpose this script as a simple one-shot tool for developers to reset
their TPM, so the next time someone asks we can just tell them 'boot a
test image in recovery mode and run chromeos-tpm-recovery'.

BRANCH=none
BUG=chromium:419942
TEST=Ran on a Jerry, confirmed that TPM spaces were reset.

Change-Id: Ia95246cfed3dc9b0c6fdb0481218e3ae14d8318a
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/271512
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Luigi Semenzato <semenzato@chromium.org>
5 years agovboot2: Support VB2_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK
Julius Werner [Fri, 15 May 2015 19:50:07 +0000 (12:50 -0700)]
vboot2: Support VB2_GBB_FLAG_DISABLE_FW_ROLLBACK_CHECK

Looks like the DISABLE_FW_ROLLBACK_CHECK GBB flag (0x200) was forgotten
in the vboot2 implementation. It's too late for Veyron now, but let's at
least fix it for future devices.

BRANCH=none
BUG=None
TEST=make runtests

Change-Id: I867f7aada28be3897efda73a6bdc3b0848c23dca
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/271419
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agoDetect GBB 1.1 also as impcompatible version
Daisuke Nojiri [Wed, 13 May 2015 22:32:14 +0000 (15:32 -0700)]
Detect GBB 1.1 also as impcompatible version

Older GBB headers (e.g. 1.0 and 1.1) do not have hwid_digest. In such cases,
PCR1 is currently extended from 0, causing a remote attestation failure.
This change makes all GBB headers older than 1.2 incompatible.

BUG=none
BRANCH=tot
TEST=make -j runtests

Change-Id: I7a3b19c2da325a3fa4b9c1fe06ed6f43cb51fb9e
Signed-off-by: Daisuke Nojiri <dnojiri@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270796
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agovboot2: Add support for kernel version secure data space
Randall Spangler [Tue, 12 May 2015 20:44:30 +0000 (13:44 -0700)]
vboot2: Add support for kernel version secure data space

Holds kernel rollback information.  Will be used by vboot 2.0 kernel
verification.

BUG=chromium:487699
BRANCH=none
TEST=make -j runtests

Change-Id: Ib4a70e943ebd79aac06404df09cf4ce62d719201
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270626
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
5 years agovboot1: Condition default legacy boot on dev_boot_legacy
Julius Werner [Sat, 9 May 2015 06:00:16 +0000 (23:00 -0700)]
vboot1: Condition default legacy boot on dev_boot_legacy

This patch fixes what I think is an inconsistency in the existing legacy
boot behavior: when the GBB flag that defaults to legacy boot is set,
running out the 30 second timer would still boot legacy mode even if
dev_boot_legacy is not actually set (whereas pressing CTRL+L in the
same configuration would beep and refuse).

This patch makes both legacy boot trgiggers check the same condition
before boot. This does not restrict functionality since anyone who sets
the DEFAULT_DEV_BOOT_LEGACY GBB flag could simply set
FORCE_DEV_BOOT_LEGACY at the same time. It does however open up an
interesting new use case of using NVRAM to change back-and-forth between
legacy and normal developer mode (after GBB flags are changed once and
write-protection is enabled again).

If this is updated in the field it might lock existing devices out of
legacy mode... however, since by far the most common GBB flag
combination recommended on the internet seems to be 0x489 (including
FORCE_DEV_BOOT_LEGACY), I doubt this would be a problem in practice.

BRANCH=tbd
BUG=chrome-os-partner:39999
TEST=Booted with GBB flags 0x4b9 and 0x439, observed difference.

Change-Id: If6a6d99ab2cf116db2237fdc3df97fc22a68251c
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270182
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
5 years agovboot1: Lock TPM physical presence (kernel rollback) on legacy boot
Julius Werner [Sat, 9 May 2015 05:54:14 +0000 (22:54 -0700)]
vboot1: Lock TPM physical presence (kernel rollback) on legacy boot

Even though legacy boot is an unsafe mode that has to be manually
initiated by the user, we should still lock the kernel TPM space to be
consistent with existing developer mode practice.

BRANCH=tbd
BUG=chrome-os-partner:39999
TEST=Spent over an hour unsuccessfully trying to get SeaBIOS to boot a
Chromium test image on my Falco. Decided that's not worth it an just
tested the firmware side of this (pressing CTRL+L when legacy mode is
enabled and disabled, multiple times, with and without GBB flag
DEFAULT_DEV_BOOT_LEGACY).

Change-Id: I3b02b59a9055431d222c0c7446de2cd7d2e0bb82
Signed-off-by: Julius Werner <jwerner@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/270181
Reviewed-by: Duncan Laurie <dlaurie@chromium.org>
5 years agoMake SHA library accessible to calling firmware
Randall Spangler [Tue, 5 May 2015 23:06:50 +0000 (16:06 -0700)]
Make SHA library accessible to calling firmware

And add a vb2_digest_buffer() call which produces the hash of a buffer
all in a single function call.  That function actually already
existed, but was in a unit test file rather than in the library
itself.  It's a small function, so adding it won't increase the size
of the library significantly - or at all, on platforms which compile
with -ffunction-sections.

This allows coreboot to reuse this SHA library for hashing CBFS
entries and file data.  All it has to do is #define
NEED_VB2_SHA_LIBRARY and then #include "vb2_api.h".

BUG=chromium:482652
BRANCH=none
TEST=make -j runtests

Change-Id: Ice2d0929324b58b2665f3989b5b887225f6ef61e
Signed-off-by: Randall Spangler <rspangler@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/269523
Reviewed-by: Julius Werner <jwerner@chromium.org>
5 years agoimage_signing: use per-board release file blacklist
Amey Deshpande [Fri, 24 Apr 2015 20:56:17 +0000 (13:56 -0700)]
image_signing: use per-board release file blacklist

This patch changes ensure_no_nonrelease_files.sh to use per-board
release file blacklist instead of the default one.  It also uses this
opportunity to make ensure_no_nonrelease_files.sh consistently
formatted.

BRANCH=none
TEST=Ran ./security_test_image on a lakitu image and --vboot_hash
pointing to this commit, and verified ensure_no_nonrelease_files.sh passes.
BUG=brillo:823

Change-Id: I2cff56192a5ff0b917faba7549e7adafb4757a47
Reviewed-on: https://chromium-review.googlesource.com/267335
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
5 years agoimage_signing: emit required_dmparams_regex in case of mismatch
Amey Deshpande [Tue, 28 Apr 2015 21:09:36 +0000 (14:09 -0700)]
image_signing: emit required_dmparams_regex in case of mismatch

BRANCH=none
TEST=none
BUG=none

Change-Id: Iece5272622467829050ca50a4842ef771addf7ae
Reviewed-on: https://chromium-review.googlesource.com/267739
Reviewed-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Amey Deshpande <ameyd@google.com>
Tested-by: Amey Deshpande <ameyd@google.com>
5 years agovboot_reference: remove dependency on trousers
Luigi Semenzato [Tue, 28 Apr 2015 18:12:18 +0000 (11:12 -0700)]
vboot_reference: remove dependency on trousers

This is done to break a circular DEPENDency as we want to
send UMA stats from tcsd.  Without this, metrics depends on
vboot_reference which depends on trousers which depends on
metrics.  Technically the vboot_reference dependency on trousers
is header-file only, but we can't cope with that.

BUG=chromium:481552
TEST=compiled with emerge-<something> vboot_reference
BRANCH=none

Change-Id: Iea5c0c39bb70977c9d375e63ea607687debe9f9f
Reviewed-on: https://chromium-review.googlesource.com/267744
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Luigi Semenzato <semenzato@chromium.org>
Tested-by: Luigi Semenzato <semenzato@chromium.org>
5 years agocgpt: Handle read errors gracefully
Dan Ehrenberg [Wed, 22 Apr 2015 18:00:51 +0000 (11:00 -0700)]
cgpt: Handle read errors gracefully

When a read fails in getting the GPT, just zero the contents of the
buffer and carry on.

Some testing changes are required for this. When a read of the GPT
fails, it is no longer fatal, so tests of that have been adjusted.
Tests have been improved to show that the GPT is automatically
repaired when a read error occurs.
There was one test which checked that a zero-sized disk would fail
to load a kernel, but it was surrounded by a number of mocked
functions which normally do that error checking, and it amounted
to the same test as read failure; that test was deleted.

BUG=chrome-os-partner:35440
TEST=vboot tests pass
BRANCH=none

Change-Id: I0c05813e7492920433733947d3fb74a7e4aa66f2
Signed-off-by: Dan Ehrenberg <dehrenberg@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/266882
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agovboot: Fix indentation in LoadKernel()
Gwendal Grignou [Mon, 27 Apr 2015 16:46:52 +0000 (09:46 -0700)]
vboot: Fix indentation in LoadKernel()

BUG=None
BRANCH=none
TEST=compile

Change-Id: I286ccb2649ee0535d3fb092b4d445488f6385a65
Signed-off-by: Gwendal Grignou <gwendal@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/267462
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agomake_dev_ssd: Add '--edit_config' to support in-place editing.
Hung-Te Lin [Wed, 22 Apr 2015 10:52:02 +0000 (18:52 +0800)]
make_dev_ssd: Add '--edit_config' to support in-place editing.

The '--save_config' and '--set_config' are found to be very useful for
developers but it's sometimes inconvenient that developer must specify a
temporary path and to know the implicit rules of how the files are generated.

Since most people just want to do in-place editing, we can add a --edit_config
so developers can simply invoke "make_dev_ssd --edit_config --partitions 2" to
start changing kernel command line without worrying about where to store the
temporary files.

BRANCH=none
BUG=none
TEST=./make_dev_ssd.sh --edit_config --partition 2

Change-Id: Ib8f19115df31f3f250b4378201d0f7ea562fec15
Reviewed-on: https://chromium-review.googlesource.com/266814
Tested-by: Hung-Te Lin <hungte@chromium.org>
Reviewed-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Hung-Te Lin <hungte@chromium.org>

5 years agovboot_reference: fix several syntax warnings found by clang.
Yunlian Jiang [Wed, 15 Apr 2015 17:26:20 +0000 (10:26 -0700)]
vboot_reference: fix several syntax warnings found by clang.

BUG=chromium:475949
TEST=CC=x86_64-cros-linux-gnu-clang CXX=x86_64-cros-linux-gnu-clang++
     emerge-falco vboot_reference
BRANCH=none
Change-Id: I3341e840c3f26f8579d35e0bb411566b0ad86164
Reviewed-on: https://chromium-review.googlesource.com/265834
Reviewed-by: Randall Spangler <rspangler@chromium.org>
Commit-Queue: Yunlian Jiang <yunlian@chromium.org>
Tested-by: Yunlian Jiang <yunlian@chromium.org>
5 years agofutility: improve help message for show command
Bill Richardson [Mon, 6 Apr 2015 20:02:40 +0000 (13:02 -0700)]
futility: improve help message for show command

No functional changes, just tweak the help message a bit.

BUG=none
BRANCH=none
TEST=make runtests

Change-Id: I3c9987560924bd6766d4e1a756a587d9aa123bbb
Signed-off-by: Bill Richardson <wfrichar@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/265740
Reviewed-by: Randall Spangler <rspangler@chromium.org>
5 years agoadd_loem_keys: new helper for quickly creating loem keys
Mike Frysinger [Mon, 16 Jun 2014 05:13:28 +0000 (01:13 -0400)]
add_loem_keys: new helper for quickly creating loem keys

This is largely geared for testing for quickly creating a set of loem keys.

BUG=chromium:381862
TEST=`./add_loem_keys.sh 0` converted an existing keyset to a loem keyset
TEST=`./add_loem_keys.sh 3` added three more keysets
TEST=ran sign_official_build.sh with new keysets against a recovery.bin
BRANCH=none

Change-Id: I598b7a453b747a231df850657df50bede01768c2
Reviewed-on: https://chromium-review.googlesource.com/203940
Reviewed-by: Gaurav Shah <gauravsh@chromium.org>
Tested-by: Mike Frysinger <vapier@chromium.org>
Commit-Queue: Mike Frysinger <vapier@chromium.org>